@everystack/model 0.4.10 → 0.4.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/can.ts

@@ -15,6 +15,26 @@ export type Action = 'read' | 'create' | 'update' | 'delete' | 'manage' | 'execu
 export interface AbilityCondition {
   /** Role-gated: policy `TO <role>` + grant. */
   role?: string;
+  /**
+   * The policy's AUDIENCE, decoupled from its grantees. Exactly one value: `'public'`.
+   *
+   * A bare `can('read')` means two things at once — *who holds the privilege* (a GRANT to
+   * anon and to authenticated) and *who the policy names* (`TO anon`, `TO authenticated`).
+   * One knob, two axes. A brownfield schema that wrote the ordinary Postgres idiom — a
+   * single policy `TO PUBLIC` — could not be expressed at all, so the plan proposed dropping
+   * it and creating two role-scoped ones. PUBLIC is an OPEN set and `{anon, authenticated}`
+   * is not, so that is a real narrowing: any other role loses the read.
+   *
+   * `policyRoles: 'public'` emits ONE policy `TO PUBLIC` and leaves the GRANTS exactly as
+   * they are derived today. **It can never add a grantee** — an open audience over a closed
+   * grant set widens nothing, because Postgres checks the GRANT first.
+   *
+   * Only `'public'` is admitted, deliberately. A free-form role list here would be a second
+   * way to spell the `role:` axis and could name a role no grant backs, which reads as access
+   * that does not exist. With the domain restricted to one open set, `policyRoles ⊇ grantees`
+   * holds structurally and there is no inverse case to guard.
+   */
+  policyRoles?: 'public';
   /** Row owner only: the column holding the owner id (`USING (<col> = auth.uid())`). */
   owner?: string;
   /**
@@ -49,11 +69,12 @@ export interface AbilityCondition {
    */
   ownerExpr?: unknown;
   /**
-   * Column-scoped exposure for a `read` ability. Names the field keys a role may read
-   * (compiled to a `GRANT SELECT (cols)` column grant, not a table grant) instead of the
-   * whole row — e.g. `can('read', { owner: 'id', columns: ['id', 'email', 'role'] })` on
-   * `auth.users` exposes id/email/role to the owner, never the password hash. Pairs with
-   * `owner` (the self policy scopes the rows; the columns scope the fields).
+   * Column-scoped exposure for a `read` or `update` ability. Names the field keys a role may
+   * read or update (compiled to `GRANT SELECT|UPDATE (cols)`, never a table grant) instead of
+   * the whole row — e.g. `can('read', { owner: 'id', columns: ['id', 'email', 'role'] })` on
+   * `auth.users` exposes id/email/role to the owner, never the password hash. Every column
+   * ability must name a `role`, an `owner`, or both: the policy scopes rows and the columns
+   * scope fields.
    */
   columns?: string[];
   /** Scalar/column predicate — a sql-tagged expression compiled to an RLS USING clause. */
@@ -85,6 +106,38 @@ export interface Ability {
   condition: AbilityCondition;
 }
 
+/**
+ * Is this an ability whose privilege is scoped to listed columns rather than the
+ * whole table? `defineModel` rejects every malformed near-miss before a descriptor
+ * reaches a compiler, so consumers can use this as the one classification rule.
+ */
+export function isColumnAbility(ability: Ability): boolean {
+  return (ability.action === 'read' || ability.action === 'update')
+    && Array.isArray(ability.condition.columns)
+    && ability.condition.columns.length > 0
+    && Boolean(ability.condition.role || ability.condition.owner);
+}
+
+/**
+ * Is this ability a PUBLIC read — a read path open to a caller with no session?
+ *
+ * The visibility question the soft-delete guard turns on: "what can someone with no session
+ * see?". Both a role-less read and `role: 'anon'` answer it the same way, because `anon` IS
+ * the anonymous role; an `owner` or `via` read answers it differently, because those scope
+ * rows to a session that exists.
+ *
+ * ONE definition, because there were two. `defineModel`'s refusal fired only on a role-less
+ * read while `db:pull`'s renderer already counted `role: 'anon'` — so a table whose
+ * authenticated read diverges (which pull renders as an anon-scoped read) slipped past the
+ * refusal while still being rendered as public. Two surfaces, two answers, one question.
+ */
+export function isPublicReadAbility(ability: Ability): boolean {
+  return ability.action === 'read'
+    && !ability.condition.owner
+    && !ability.condition.via
+    && (!ability.condition.role || ability.condition.role === 'anon');
+}
+
 /** Declare one authorization rule. */
 export function can(action: Action, condition: AbilityCondition = {}): Ability {
   return { action, condition };

package/src/drizzle.ts

@@ -18,6 +18,7 @@ import {
   pgTable,
   pgSchema,
   pgEnum,
+  customType,
   text,
   uuid,
   integer,
@@ -106,6 +107,13 @@ function baseColumn(columnName: string, spec: FieldSpec): PgColumnBuilderBase {
       return json(columnName);
     case 'enum':
       return getEnum(spec)(columnName);
+    case 'pgType': {
+      // A verbatim type: drizzle carries the exact string as the column's SQL
+      // type and the value stays `unknown` — no client-side typing is promised.
+      const typeName = spec.pgTypeName;
+      if (!typeName) throw new Error('pgType field is missing pgTypeName');
+      return customType<{ data: unknown }>({ dataType: () => typeName })(columnName);
+    }
     default: {
       const exhaustive: never = spec.type;
       throw new Error(`Unsupported field type: ${String(exhaustive)}`);

package/src/field.ts

@@ -12,6 +12,7 @@
  */
 
 import type { RawSql } from './raw-sql';
+import { pgTypeRefusal } from './pg-type';
 
 export type FieldType =
   | 'text'
@@ -30,7 +31,8 @@ export type FieldType =
   | 'varchar'
   | 'json'
   | 'jsonb'
-  | 'enum';
+  | 'enum'
+  | 'pgType';
 
 export type DefaultKind = 'value' | 'now' | 'random' | 'sql';
 
@@ -49,6 +51,14 @@ export interface FieldSpec {
   scale?: number;
   /** `varchar(length)` — maximum character length. */
   length?: number;
+  /**
+   * The verbatim Postgres type of a `pgType` field — the exact canonical
+   * `format_type` spelling (`hstore`, `geometry(Geometry,4326)`, `tsvector`).
+   * The string IS the type's identity: introspection, the differ, and the
+   * fingerprint all compare it byte-for-byte, so a pulled column round-trips
+   * with no coercion and no drift.
+   */
+  pgTypeName?: string;
   isPrimaryKey: boolean;
   isNotNull: boolean;
   isUnique: boolean;
@@ -94,7 +104,7 @@ export interface FieldSpec {
 export class FieldBuilder {
   readonly spec: FieldSpec;
 
-  constructor(type: FieldType, extra?: Pick<FieldSpec, 'enumName' | 'enumValues' | 'precision' | 'scale' | 'length'>) {
+  constructor(type: FieldType, extra?: Pick<FieldSpec, 'enumName' | 'enumValues' | 'precision' | 'scale' | 'length' | 'pgTypeName'>) {
     this.spec = {
       type,
       enumName: extra?.enumName,
@@ -102,6 +112,7 @@ export class FieldBuilder {
       precision: extra?.precision,
       scale: extra?.scale,
       length: extra?.length,
+      pgTypeName: extra?.pgTypeName,
       isPrimaryKey: false,
       isNotNull: false,
       isUnique: false,
@@ -252,4 +263,19 @@ export const field = {
   json: (): FieldBuilder => new FieldBuilder('json'),
   /** A Postgres enum. The `name` is the `CREATE TYPE` name and is always explicit, so `db:pull` round-trips it. */
   enum: (name: string, values: readonly string[]): FieldBuilder => new FieldBuilder('enum', { enumName: name, enumValues: values }),
+  /**
+   * A verbatim Postgres type the vocabulary has no first-class field for —
+   * `field.pgType('hstore')`, `field.pgType('geometry(Geometry,4326)')`,
+   * `field.pgType('tsvector')`. The exact string is the column's type, end to
+   * end: DDL emits it verbatim, introspection reports it verbatim, and the
+   * differ/fingerprint compare it byte-for-byte — so an extension-typed column
+   * round-trips with no coercion. The spelling must be canonical and must not
+   * shadow a first-class field (one type, one spelling): non-canonical or
+   * first-class spellings are refused with the correct call named.
+   */
+  pgType: (typeName: string): FieldBuilder => {
+    const refusal = pgTypeRefusal(typeName);
+    if (refusal) throw new Error(refusal);
+    return new FieldBuilder('pgType', { pgTypeName: typeName });
+  },
 } as const;

package/src/index.ts

@@ -10,13 +10,17 @@
 export { field, FieldBuilder } from './field';
 export type { FieldSpec, FieldType, DefaultKind, ReferentialAction } from './field';
 
+export { canonicalColumnType, fieldFactoryCall, pgTypeRefusal } from './pg-type';
+
+export { parseQualified } from './qualified';
+
 export { unique, check, index, foreignKey, IndexBuilder } from './constraints';
 export type { TableConstraint } from './constraints';
 
 export { sql } from './raw-sql';
 export type { RawSql } from './raw-sql';
 
-export { can } from './can';
+export { can, isColumnAbility, isPublicReadAbility } from './can';
 export type { Ability, AbilityCondition, Action } from './can';
 
 export { belongsTo, hasMany } from './relations';

package/src/model.ts

@@ -13,6 +13,7 @@
 
 import type { FieldBuilder } from './field';
 import type { Ability } from './can';
+import { isPublicReadAbility } from './can';
 import type { Relation } from './relations';
 import type { TableConstraint } from './constraints';
 import type { RawSql } from './raw-sql';
@@ -207,6 +208,72 @@ export function defineModel(table: string, def: ModelDefinition): ModelDescripto
     if (a.action === 'execute') {
       throw new Error(`model '${table}': can('execute') is a function ability — declare it on the defineFunction it gates.`);
     }
+
+    // A column list is authorization, not a selection hint. If it reaches a table-grant path
+    // unnoticed, Postgres receives a whole-table privilege. Admit only the shapes the column
+    // compiler understands, and reject an empty list because it is indistinguishable from no
+    // column scope at all.
+    if (a.condition.columns !== undefined) {
+      if (a.action !== 'read' && a.action !== 'update') {
+        throw new Error(
+          `model '${table}': columns apply only to can('read') or can('update'), not can('${a.action}').`,
+        );
+      }
+      if (!Array.isArray(a.condition.columns) || a.condition.columns.length === 0) {
+        throw new Error(
+          `model '${table}': columns must be a non-empty array on can('${a.action}'); an empty list would erase the column scope.`,
+        );
+      }
+      if (!a.condition.role && !a.condition.owner) {
+        throw new Error(
+          `model '${table}': columns require role and/or owner on can('${a.action}'); otherwise the intended column grant has no declared grantee or row gate.`,
+        );
+      }
+      if (a.condition.policyRoles !== undefined) {
+        throw new Error(
+          `model '${table}': columns cannot use policyRoles. A column ability's policy is TO its declared role (or authenticated for owner-only), never an open audience.`,
+        );
+      }
+      if (a.condition.owner && !(a.condition.owner in def.fields)) {
+        throw new Error(
+          `model '${table}': columns names owner '${a.condition.owner}', but no such field exists.`,
+        );
+      }
+      for (const column of a.condition.columns) {
+        if (!(column in def.fields)) {
+          throw new Error(
+            `model '${table}': columns names '${column}', but no such field exists. Column abilities use model field keys.`,
+          );
+        }
+      }
+    }
+
+    // `policyRoles` decouples the policy's AUDIENCE from its GRANTEES, and it is deliberately
+    // amputated to one open set. Anything else would be a second spelling of the `role:` axis
+    // and could name a role no grant backs — a policy that reads as access which does not
+    // exist. A key that cannot say NO is not a fix, so it says NO here, at authoring time.
+    if (a.condition.policyRoles !== undefined) {
+      if (a.condition.policyRoles !== 'public') {
+        throw new Error(
+          `model '${table}': policyRoles admits exactly one value, 'public' — got ` +
+            `${JSON.stringify(a.condition.policyRoles)}. It exists to express a single policy TO PUBLIC, ` +
+            `the open audience a brownfield schema already wrote. To gate on a named role use role: '<name>', ` +
+            `which sets the grant too.`,
+        );
+      }
+      if (a.action !== 'read') {
+        throw new Error(
+          `model '${table}': policyRoles is a READ audience — can('${a.action}', { policyRoles: 'public' }) would ` +
+            `open a write policy to every role. Declare writes with role:/owner:.`,
+        );
+      }
+      if (a.condition.role) {
+        throw new Error(
+          `model '${table}': policyRoles: 'public' and role: '${a.condition.role}' both name the policy's audience. ` +
+            `Declare one. policyRoles states the audience and leaves the grants alone; role states both.`,
+        );
+      }
+    }
   }
 
   // An array field's value default must be a JS array — `.default([])`, not the
@@ -230,10 +297,19 @@ export function defineModel(table: string, def: ModelDefinition): ModelDescripto
   // so there is no default: on the exact set of models where the answer changes behaviour (a
   // `deletedAt` field plus a public read), it must be declared. `softDelete: true` is what the
   // inference used to do.
-  const hasPublicRead = (def.abilities ?? []).some(
-    (a) => a.action === 'read' && !a.condition.role && !a.condition.owner && !a.condition.via,
-  );
-  if ('deletedAt' in def.fields && hasPublicRead && def.softDelete === undefined) {
+  // `isPublicReadAbility`, not a local copy: this refusal and db:pull's renderer were asking
+  // the same question — "can a caller with no session see these rows?" — and answering it
+  // differently. The renderer already counted `role: 'anon'`; this refusal did not, so a table
+  // whose authenticated read diverges (rendered as an anon-scoped read) slipped past the very
+  // decision the refusal exists to force. It now fires on the anonymous audience however it is
+  // spelled. Explicit `softDelete: false` remains the one-line answer, and pull writes that
+  // line into every model it renders, so a pulled checkout keeps loading.
+  const hasPublicRead = (def.abilities ?? []).some(isPublicReadAbility);
+  // Both spellings of the field key. The guard used to test `'deletedAt' in def.fields`
+  // literally, so a model keying the column `deleted_at` — the shape a snake_case brownfield
+  // schema pulls as — carried a soft-delete column past a guard that never looked at it.
+  const softDeleteField = 'deletedAt' in def.fields || 'deleted_at' in def.fields;
+  if (softDeleteField && hasPublicRead && def.softDelete === undefined) {
     throw new Error(
       `model '${table}': has a 'deletedAt' field and a public read, so it must declare softDelete. `
         + `softDelete: true excludes soft-deleted rows from the public read policies (what the compiler used to infer from the field's presence); `

package/src/module.ts

@@ -22,6 +22,8 @@
 import type { ModelDescriptor } from './model';
 import type { DerivedDescriptor, SequenceDescriptor } from './derived';
 import { rejectHoles, functionArgSignature } from './derived';
+import { deriveFunctionSchemas } from './derive';
+import { parseQualified } from './qualified';
 
 export interface ModuleDefinition {
   /** The package's Models (schema + authz). */
@@ -114,6 +116,7 @@ export function defineModule(def: ModuleDefinition): Module {
     }
     seen.add(identity);
   }
+  assertFunctionsAreDeclared(def);
   return {
     models: def.models ?? [],
     extensions: def.extensions ?? [],
@@ -124,6 +127,75 @@ export function defineModule(def: ModuleDefinition): Module {
   };
 }
 
+/**
+ * `writtenBy: 'functions'` is a PROMISE that functions do the writing. This is where the
+ * promise gets checked.
+ *
+ * The defect it closes, found 2026-08-04: `@everystack/auth` declared seven models
+ * `writtenBy: 'functions'` and shipped 21 SECURITY DEFINER functions — through the deprecated
+ * `functions` thunk, which exactly ONE command reads (`db:generate --init`). `db:reconcile`
+ * reads `derived`, and `derived` was empty. So a brownfield adopter installed the tables, got
+ * ENABLE-not-FORCE RLS on the strength of `writtenBy: 'functions'`, installed none of the
+ * functions that were supposed to be the only writers, and every gate reported clean. The
+ * declaration and the thing it depends on were checked by nobody.
+ *
+ * The check is per-MODULE, not across the composed set: a module that owns a
+ * functions-written model owns the functions that write it, and firing here can name the
+ * module at fault. Across modules the error arrives after everything is flattened and can
+ * only say that something, somewhere, is missing.
+ *
+ * A thunk downgrades the error to a warning rather than satisfying the check — the thunk lane
+ * does install, just on one command, so a consumer still on it is degraded and not broken.
+ */
+function assertFunctionsAreDeclared(def: ModuleDefinition): void {
+  const models = def.models ?? [];
+  const owed = deriveFunctionSchemas(models);
+  const declared = new Set(
+    (def.derived ?? [])
+      .filter((d) => (d.kind === 'sql' ? d.objectKind : d.kind) === 'function')
+      .map((d) => parseQualified(d.name).schema),
+  );
+  const missing = owed.filter((schema) => !declared.has(schema));
+
+  if (missing.length === 0) {
+    if (def.functions) {
+      console.warn(
+        'defineModule: the `functions` thunk is deprecated and only `db:generate --init` reads it — '
+        + '`db:reconcile` reads `derived`, so anything declared there alone never reaches a brownfield '
+        + 'database. Move it to `derived: [defineFunction(…)]`.',
+      );
+    }
+    return;
+  }
+
+  const blame = missing
+    .map((schema) => {
+      const tables = models
+        .filter((m) => m.writtenBy === 'functions' && m.schema === schema)
+        .map((m) => `${m.schema}.${m.table}`)
+        .sort();
+      return `schema '${schema}' (${tables.join(', ')})`;
+    })
+    .join('; ');
+
+  if (def.functions) {
+    console.warn(
+      `defineModule: ${blame} declares writtenBy: 'functions' but every function is in the deprecated `
+      + '`functions` thunk, which only `db:generate --init` reads. `db:reconcile` reads `derived`, so a '
+      + 'brownfield database gets the tables and none of their writers. Move them to '
+      + '`derived: [defineFunction(…)]`.',
+    );
+    return;
+  }
+
+  throw new Error(
+    `defineModule: ${blame} declares writtenBy: 'functions' but the module declares no function in `
+    + `that schema. writtenBy: 'functions' is what turns RLS FORCE off, so the tables ship writable `
+    + `only by functions that do not exist. Declare them as \`derived: [defineFunction('${missing[0]}.…', …)]\`, `
+    + `or change writtenBy if functions are not the writer.`,
+  );
+}
+
 /** The flattened model list across modules — for everything that still takes a model array
  *  (handler-config derivation, FORCE carveouts, the drift guard). */
 export function moduleModels(modules: Module[]): ModelDescriptor[] {

package/src/pg-type.ts

@@ -0,0 +1,97 @@
+/**
+ * pg-type — the ONE definition of a column type's spelling.
+ *
+ * Three questions, answered here and only here, so every surface (the field
+ * factory, db:pull's renderer, introspection, the differ, the fingerprint)
+ * agrees by construction:
+ *
+ *  1. What is the canonical spelling of a `format_type` string?
+ *     (`canonicalColumnType` — the v5 rule: a redundant default precision is
+ *     not part of a type's identity.)
+ *  2. Which spellings are already owned by a first-class `field.*()` factory?
+ *     (`fieldFactoryCall` — the inverse map db:pull renders with, and the map
+ *     `field.pgType` refuses against, so one type always has one spelling.)
+ *  3. Everything else is carried VERBATIM by `field.pgType(...)` — the type
+ *     string itself is the identity, end to end.
+ */
+
+/**
+ * Canonicalize a `format_type` spelling. Only the redundant default precision,
+ * only the timestamp/time family: `timestamp(6) without time zone` is the same
+ * type as `timestamp without time zone` (6 is the family default), so both
+ * spell the canonical, shorter form. `timestamp(3)` is a real difference and
+ * passes through untouched.
+ */
+export function canonicalColumnType(type: string): string {
+  return type.replace(/^(timestamp|timestamptz|time|timetz)\(6\)(\s|$)/, '$1$2');
+}
+
+/** `format_type` → the `field.*()` factory that produces it (the non-parameterized types). */
+const FIELD_FACTORY: Record<string, string> = {
+  uuid: 'uuid',
+  text: 'text',
+  integer: 'integer',
+  bigint: 'bigint',
+  real: 'real',
+  'double precision': 'doublePrecision',
+  boolean: 'boolean',
+  json: 'json',
+  jsonb: 'jsonb',
+  date: 'date',
+  'timestamp with time zone': 'timestamptz',
+  'timestamp without time zone': 'timestamp',
+  timestamp: 'timestamp',
+};
+
+/**
+ * The full `field.*()` call for a `format_type` string, or null when no
+ * first-class field maps it. Handles the parameterized types `format_type`
+ * spells out — `numeric(p,s)` and `character varying(n)` — so a pulled column
+ * round-trips back to the same DDL. A scale-0 numeric renders as the cleaner
+ * `field.numeric(p)` (identical to `(p, 0)`).
+ */
+export function fieldFactoryCall(type: string): string | null {
+  // An array is its base type + `.array()` — exactly how the compiler emits it
+  // (`format_type` spells arrays `text[]`). An array of an unmapped base stays null.
+  if (type.endsWith('[]')) {
+    const base = fieldFactoryCall(type.slice(0, -2));
+    return base ? `${base}.array()` : null;
+  }
+
+  const direct = FIELD_FACTORY[type];
+  if (direct) return `field.${direct}()`;
+
+  const num = type.match(/^numeric(?:\((\d+),(\d+)\))?$/);
+  if (num) {
+    if (num[1] == null) return 'field.numeric()';
+    return num[2] === '0' ? `field.numeric(${num[1]})` : `field.numeric(${num[1]}, ${num[2]})`;
+  }
+
+  const vc = type.match(/^character varying(?:\((\d+)\))?$/);
+  if (vc) return vc[1] != null ? `field.varchar(${vc[1]})` : 'field.varchar()';
+
+  return null;
+}
+
+/**
+ * Validate the argument of `field.pgType(...)`. Returns the reason the spelling
+ * is refused, or null when it may be carried verbatim. Refusals exist so a type
+ * never has two spellings in the vocabulary — the split-identity family of bugs.
+ */
+export function pgTypeRefusal(typeName: string): string | null {
+  const t = typeName.trim();
+  if (!t) return 'field.pgType() needs a Postgres type name';
+  if (t !== typeName) return `field.pgType('${typeName}'): no surrounding whitespace — write '${t}'`;
+  if (t.endsWith('[]')) {
+    return `field.pgType('${t}'): declare the scalar and add .array() — field.pgType('${t.slice(0, -2)}').array()`;
+  }
+  const canonical = canonicalColumnType(t);
+  if (canonical !== t) {
+    return `field.pgType('${t}'): the canonical spelling is '${canonical}' — a redundant default precision is not part of the type's identity`;
+  }
+  const firstClass = fieldFactoryCall(t);
+  if (firstClass) {
+    return `field.pgType('${t}'): this type is first-class — use ${firstClass}`;
+  }
+  return null;
+}

package/src/qualified.ts

@@ -0,0 +1,34 @@
+/**
+ * Splitting a declared name into `{ schema, name }`.
+ *
+ * This lives in `@everystack/model` because the names it parses are MODEL vocabulary: a
+ * descriptor declares `defineFunction('auth.sign_in_session', …)` and a model declares its
+ * `schema` separately, so anything that has to line those two up — the composition guard here,
+ * every emitter and the reconciler in `@everystack/cli` — must agree on where the dot is. The
+ * cli re-exports this from `derived-source.ts`, so there is ONE definition and its callers
+ * cannot drift apart. (Same reasoning as `fieldFactoryCall`: the parser belongs with the
+ * vocabulary it parses, not with the first consumer that needed it.)
+ *
+ * `public` is the unqualified default because that is what PostgreSQL resolves a bare name to
+ * under the default `search_path` — the parse must match the server, not a convention.
+ */
+
+/** Strip quotes from an identifier and split an optionally schema-qualified name. */
+export function parseQualified(raw: string): { schema: string; name: string } {
+  const parts: string[] = [];
+  let current = '';
+  let quoted = false;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (ch === '"') {
+      if (quoted && raw[i + 1] === '"') { current += '"'; i++; continue; }
+      quoted = !quoted;
+      continue;
+    }
+    if (ch === '.' && !quoted) { parts.push(current); current = ''; continue; }
+    current += ch;
+  }
+  parts.push(current);
+  if (parts.length >= 2) return { schema: parts[0], name: parts.slice(1).join('.') };
+  return { schema: 'public', name: parts[0] };
+}